EIP-2026-103704

This exploit leverages a bug in JavaScriptCore's TypedArray.copyWithin function, where a neutered array and large indices allow writing to absolute memory pointers. The PoC demonstrates arbitrary memory write via crafted indices and a valueOf function that neuters the array.